Buggy code:
public class SQLStoreQuery extends AbstractStoreQuery { private static final Localizer _loc = Localizer . forPackage ( SQLStoreQuery . class ) ; private final transient JDBCStore _store ; public SQLStoreQuery ( JDBCStore store ) { } public JDBCStore getStore ( ) { } public boolean supportsParameterDeclarations ( ) { } public boolean supportsDataStoreExecution ( ) { } public Executor newDataStoreExecutor ( ClassMetaData meta , boolean subclasses ) { } public boolean requiresCandidateType ( ) { } public boolean requiresParameterDeclarations ( ) { } protected static class SQLExecutor extends AbstractExecutor { private final ClassMetaData _meta ; private final boolean _select ; private final boolean _call ; private final QueryResultMapping _resultMapping ; public SQLExecutor ( SQLStoreQuery q , ClassMetaData candidate ) { } public int getOperation ( StoreQuery q ) { } public Number executeUpdate ( StoreQuery q , Object [ ] params ) { } public ResultObjectProvider executeQuery ( StoreQuery q , Object [ ] params , Range range ) { } public String [ ] getDataStoreActions ( StoreQuery q , Object [ ] params , Range range ) { } public boolean isPacking ( StoreQuery q ) { } protected PreparedStatement prepareCall ( Connection conn , SQLBuffer buf ) throws SQLException { } protected int executeUpdate ( JDBCStore store , Connection conn , PreparedStatement stmnt , SQLBuffer buf ) throws SQLException { } protected PreparedStatement prepareCall ( Connection conn , SQLBuffer buf , JDBCFetchConfiguration fetch , int rsType , int rsConcur ) throws SQLException { } protected PreparedStatement prepareStatement ( Connection conn , SQLBuffer buf ) throws SQLException { } protected PreparedStatement prepareStatement ( Connection conn , SQLBuffer buf , JDBCFetchConfiguration fetch , int rsType , int rsConcur ) throws SQLException { } protected ResultSet executeQuery ( JDBCStore store , Connection conn , PreparedStatement stmnt , SQLBuffer buf , List paramList ) throws SQLException { } public Object [ ] toParameterArray ( StoreQuery q , Map userParams ) { } } public static String substituteParams ( String sql , List < Integer > paramOrder ) throws IOException { if ( ( sql . indexOf ( "?" ) ) == ( - 1 ) ) return sql ; paramOrder . clear ( ) ; StreamTokenizer tok = new StreamTokenizer ( new StringReader ( sql ) ) ; tok . resetSyntax ( ) ; tok . quoteChar ( '\'' ) ; tok . wordChars ( '0' , '9' ) ; tok . wordChars ( '?' , '?' ) ; <START_BUG> StringBuffer buf = new StringBuffer ( sql . length ( ) ) ; <END_BUG> for ( int ttype ; ( ttype = tok . nextToken ( ) ) != ( StreamTokenizer . TT_EOF ) ; ) { switch ( ttype ) { case StreamTokenizer . TT_WORD : if ( tok . sval . startsWith ( "?" ) ) { buf . append ( "?" ) ; String pIndex = tok . sval . substring ( 1 ) ; if ( ( pIndex . length ( ) ) > 0 ) { paramOrder . add ( Integer . valueOf ( pIndex ) ) ; } else { paramOrder . add ( ( ( paramOrder . size ( ) ) + 1 ) ) ; } } else buf . append ( tok . sval ) ; break ; case '\'' : buf . append ( '\'' ) ; if ( ( tok . sval ) != null ) { buf . append ( tok . sval ) ; buf . append ( '\'' ) ; } break ; default : buf . append ( ( ( char ) ( ttype ) ) ) ; } } return buf . toString ( ) ; } }

Fix:
StringBuilder buf = new StringBuilder ( sql . length ( ) ) ;